diff --git a/core/android_exploit.py b/core/android_exploit.py
index b1571cc..dfaf90d 100644
--- a/core/android_exploit.py
+++ b/core/android_exploit.py
@@ -1400,6 +1400,80 @@ class AndroidExploitManager:
                 'tool': 'https://github.com/schnatterer/rooted-graphene',
             })
 
+        # ── Android 15/16 specific exploits ──────────────────────────
+
+        # CVE-2025-48543: ART UAF → system UID (Android 13-16, pre-Sep 2025)
+        if sdk_int >= 33 and patch < '2025-09-05':
+            vulns.append({
+                'cve': 'CVE-2025-48543',
+                'name': 'ART runtime UAF → system UID',
+                'severity': 'high',
+                'type': 'system_uid',
+                'description': 'Use-after-free in Android Runtime achieves system_server UID. '
+                               'Can disable MDM, access system app data. Public PoC available.',
+                'requirements': 'Malicious app installed (no ADB needed) or push via ADB',
+                'reliability': 'medium (PoC needs validation)',
+                'stealth': 'moderate',
+                'exploitable': True,
+                'public_poc': 'https://github.com/gamesarchive/CVE-2025-48543',
+                'note': 'Works on Android 15/16. Chain with pKVM bug for full kernel root.',
+            })
+
+        # CVE-2025-48572 + CVE-2025-48633: Framework info leak + EoP (Android 13-16, pre-Dec 2025)
+        if sdk_int >= 33 and patch < '2025-12-05':
+            vulns.append({
+                'cve': 'CVE-2025-48572/48633',
+                'name': 'Framework info leak + EoP chain (in-the-wild)',
+                'severity': 'critical',
+                'type': 'system_uid',
+                'description': 'Framework info disclosure + controlled privilege escalation. '
+                               'CISA KEV listed. Used in targeted spyware attacks.',
+                'requirements': 'Malicious app',
+                'reliability': 'high (nation-state confirmed)',
+                'stealth': 'high',
+                'exploitable': False,  # No public PoC
+                'note': 'No public PoC — commercial/state spyware only. Monitor for leak.',
+            })
+
+        # pKVM kernel bugs (Dec 2025 + Mar 2026) — second stage from system UID
+        if sdk_int >= 34 and patch < '2026-03-05':
+            pkvm_cves = []
+            if patch < '2025-12-05':
+                pkvm_cves.extend(['CVE-2025-48623', 'CVE-2025-48624'])
+            if patch < '2026-03-05':
+                pkvm_cves.extend(['CVE-2026-0037', 'CVE-2026-0027', 'CVE-2026-0028'])
+            if pkvm_cves:
+                vulns.append({
+                    'cve': ', '.join(pkvm_cves),
+                    'name': 'pKVM kernel/hypervisor escalation',
+                    'severity': 'critical',
+                    'type': 'kernel_root',
+                    'description': f'pKVM memory corruption bugs ({len(pkvm_cves)} CVEs). '
+                                   f'Second-stage: requires system UID first (chain with CVE-2025-48543).',
+                    'requirements': 'System UID as entry point (chain exploit)',
+                    'reliability': 'medium',
+                    'stealth': 'low',
+                    'exploitable': any(v.get('type') == 'system_uid' and v.get('exploitable')
+                                       for v in vulns),
+                    'note': 'Chain: CVE-2025-48543 (system) → pKVM bug (kernel root)',
+                })
+
+        # avbroot for Android 15/16 (works on any Pixel with unlocked BL)
+        if os_info.get('bootloader_unlocked') and sdk_int >= 35:
+            vulns.append({
+                'cve': 'N/A',
+                'name': 'avbroot + KernelSU/Magisk (Android 15/16)',
+                'severity': 'info',
+                'type': 'persistent_root',
+                'description': 'Patch OTA with avbroot + KernelSU-Next/Magisk for GKI 6.1/6.6. '
+                               'Flash custom AVB key, relock bootloader. Confirmed Pixel 9.',
+                'requirements': 'Unlocked bootloader, avbroot, KernelSU-Next or Magisk APK',
+                'reliability': 'high',
+                'stealth': 'moderate',
+                'exploitable': True,
+                'tool': 'https://github.com/chenxiaolong/avbroot',
+            })
+
         # Cellebrite USB chain (CVE-2024-53104)
         if patch < '2025-02-01':
             note = ''